Lab 1-2

1) Upload the Lab01-02.exe file to http://www.VirusTotal.com/. Does it match any existing antivirus definitions?

File Lab01-02.exe was first submitted to Virustotal on 2011-07-02 17:02:09 and since then it has as 44/68 detection rate:

File name: Lab01-02.exe

SHA256: c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a6

2) Are there any indications that this file is packed or obfuscated? If so, what are these indicators? If the file is packed, unpack it if possible.

Yes. The Entry Point is at the UPX1 section, which gives us the information that this Sample is packed with UPX.

We can unpack it running UPX: upx –o Lab01-02_unpacked.exe –d Lab01-02.exe

3) Do any imports hint at this program’s functionality? If so, which imports are they and what do they tell you?

The imports of the Unpacked version hint that this Malware has the ability to perform external connections (InternetOpenA and InternetOpenUrlA), also the malware creates a Service (CreateServiceA).

4) What host- or network-based indicators could be used to identify this malware on infected machines?

One of the strings is “http://www.malwareanalysisbook.com”, this domain might be a C2 and requires further investigation.